feat: Improve validation of JIDs

Add new `jid_is_valid()` function and improve the adherence to XMPP RFCs
in jid_create().

Add unit tests for them as well.

src/xmpp/jid.c

@@ -43,23 +43,31 @@
 #include "common.h"
 #include "xmpp/jid.h"
 
+#define JID_MAX_PART_LEN  1023
+#define JID_MAX_TOTAL_LEN 3071
+
+static gboolean
+_is_invalid_local_char(gunichar c)
+{
+    // RFC 6122: " & ' / : < > @
+    // Also space is forbidden.
+    return (c == ' ' || c == '"' || c == '&' || c == '\'' || c == '/' || c == ':' || c == '<' || c == '>' || c == '@');
+}
+
 Jid*
 jid_create(const gchar* const str)
 {
-    Jid* result = NULL;
+    if (str == NULL) {
+        return NULL;
+    }
 
-    /* if str is NULL g_strdup returns NULL */
     gchar* trimmed = g_strdup(str);
     if (trimmed == NULL) {
         return NULL;
     }
 
-    if (strlen(trimmed) == 0) {
-        g_free(trimmed);
-        return NULL;
-    }
-
-    if (g_str_has_prefix(trimmed, "/") || g_str_has_prefix(trimmed, "@")) {
+    size_t len = strlen(trimmed);
+    if (len == 0 || len > JID_MAX_TOTAL_LEN) {
         g_free(trimmed);
         return NULL;
     }
@@ -69,39 +77,81 @@ jid_create(const gchar* const str)
         return NULL;
     }
 
-    result = g_new0(Jid, 1);
+    Jid* result = g_new0(Jid, 1);
     result->refcnt = 1;
+    result->str = trimmed;
 
-    gchar* atp = g_utf8_strchr(trimmed, -1, '@');
     gchar* slashp = g_utf8_strchr(trimmed, -1, '/');
-    gchar* domain_start = trimmed;
-
-    if (atp) {
-        result->localpart = g_utf8_substring(trimmed, 0, g_utf8_pointer_to_offset(trimmed, atp));
-        domain_start = atp + 1;
-    }
+    auto_gchar gchar* bare = NULL;
 
     if (slashp) {
         result->resourcepart = g_strdup(slashp + 1);
-        result->domainpart = g_utf8_substring(domain_start, 0, g_utf8_pointer_to_offset(domain_start, slashp));
-        auto_gchar gchar* barejidraw = g_utf8_substring(trimmed, 0, g_utf8_pointer_to_offset(trimmed, slashp));
-        result->barejid = g_utf8_strdown(barejidraw, -1);
+        bare = g_utf8_substring(trimmed, 0, g_utf8_pointer_to_offset(trimmed, slashp));
         result->fulljid = g_strdup(trimmed);
     } else {
-        result->domainpart = g_strdup(domain_start);
-        result->barejid = g_utf8_strdown(trimmed, -1);
+        bare = g_strdup(trimmed);
     }
 
-    if (result->domainpart == NULL) {
+    // Validate resourcepart
+    if (result->resourcepart) {
+        size_t rlen = strlen(result->resourcepart);
+        if (rlen == 0 || rlen > JID_MAX_PART_LEN) {
+            jid_destroy(result);
+            return NULL;
+        }
+    }
+
+    gchar* atp = g_utf8_strchr(bare, -1, '@');
+    gchar* domain_start = bare;
+
+    if (atp) {
+        result->localpart = g_utf8_substring(bare, 0, g_utf8_pointer_to_offset(bare, atp));
+        domain_start = atp + 1;
+
+        // Validate localpart
+        size_t llen = strlen(result->localpart);
+        if (llen == 0 || llen > JID_MAX_PART_LEN) {
+            jid_destroy(result);
+            return NULL;
+        }
+
+        const gchar* p = result->localpart;
+        while (*p) {
+            gunichar c = g_utf8_get_char(p);
+            if (_is_invalid_local_char(c)) {
+                jid_destroy(result);
+                return NULL;
+            }
+            p = g_utf8_next_char(p);
+        }
+    }
+
+    result->domainpart = g_strdup(domain_start);
+    result->barejid = g_utf8_strdown(bare, -1);
+
+    // Validate domainpart
+    size_t dlen = result->domainpart ? strlen(result->domainpart) : 0;
+    if (dlen == 0 || dlen > JID_MAX_PART_LEN) {
         jid_destroy(result);
         return NULL;
     }
 
-    result->str = trimmed;
+    // Domainpart cannot contain @
+    if (g_utf8_strchr(result->domainpart, -1, '@')) {
+        jid_destroy(result);
+        return NULL;
+    }
 
     return result;
 }
 
+gboolean
+jid_is_valid(const gchar* const str)
+{
+    auto_jid Jid* jid = jid_create(str);
+    return (jid != NULL);
+}
+
 Jid*
 jid_create_from_bare_and_resource(const gchar* const barejid, const gchar* const resource)
 {

src/xmpp/jid.h

@@ -52,6 +52,7 @@ struct jid_t
 typedef struct jid_t Jid;
 
 Jid* jid_create(const gchar* const str);
+gboolean jid_is_valid(const gchar* const str);
 Jid* jid_create_from_bare_and_resource(const gchar* const barejid, const gchar* const resource);
 void jid_destroy(Jid* jid);
 void jid_ref(Jid* jid);